CVE-2026-103007: Elasticsearch Privilege Escalation Vulnerability

CVE-2026-103007 Overview

CVE-2026-103007 is an Incorrect Authorization vulnerability [CWE-863] in Elasticsearch. The flaw affects a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check does not fully enforce that scope, allowing a user with the delegated privilege to update their own role and access restricted indices, including internal security data. Successful exploitation can escalate to full administrative control of the cluster. Elastic published the fix in versions 8.19.22, 9.4.7, and 9.5.4 via security advisory ESA-2026-197.

Critical Impact
An authenticated user holding a delegated role-management privilege can escalate to full cluster administrator and read internal security indices.

Affected Products

Elasticsearch versions prior to 8.19.22
Elasticsearch 9.x versions prior to 9.4.7
Elasticsearch 9.5.x versions prior to 9.5.4

Discovery Timeline

2026-10-06 - CVE-2026-103007 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-103007

Vulnerability Analysis

Elasticsearch supports delegated role management, where an administrator can grant a user the ability to manage roles bound to a defined set of indices. The authorization check that enforces the index scope does not fully account for role-definition settings that can expand the matched index set. A user holding the delegated privilege with a broadly-scoped index pattern can modify their own assigned role. The modification can reference indices that fall outside the intended administrative boundary. Once the role is updated, the user gains read and write access to indices that should remain restricted. These indices include internal security data such as role definitions, API keys, and user records. With access to the security index, the attacker can create new administrative roles or reassign privileges, reaching full cluster control.

Root Cause

The root cause is an incomplete authorization check during role updates. The check validates the caller's declared scope but does not re-evaluate the effective index set produced by the modified role definition. This inconsistency between the declared scope and the computed scope allows the caller to bypass the intended boundary.

Attack Vector

Exploitation requires network access to the Elasticsearch API and valid credentials for an account holding the delegated role-management privilege with a broad index pattern. No user interaction is required. The attacker invokes the role management API to update the role bound to their own account, then issues follow-up requests against newly reachable indices. See the Elastic Discuss Security Update ESA-2026-197 for vendor technical details.

Detection Methods for CVE-2026-103007

Indicators of Compromise

Unexpected PUT /_security/role/* or POST /_security/role/* API calls originating from non-administrative accounts.
Role definitions that reference the .security index or wildcard index patterns such as * and .*.
New or modified API keys and user grants created shortly after a role update.
Searches or reads targeting the .security-7 or .security-* internal indices from accounts without historical access.

Detection Strategies

Audit Elasticsearch security audit logs for role modifications where the caller is the target of the role assignment.
Correlate role update events with subsequent index access against previously unauthorized indices.
Alert on any role definition change that expands index patterns or adds manage_security or all cluster privileges.

Monitoring Recommendations

Enable the Elasticsearch security audit log with authentication_success, access_granted, and realm_authentication_success events.
Forward audit logs to a centralized analytics platform and build detections for role-management anomalies.
Track baseline API usage per service account and alert on deviations against the _security endpoints.

How to Mitigate CVE-2026-103007

Immediate Actions Required

Upgrade Elasticsearch to 8.19.22, 9.4.7, or 9.5.4 as specified in ESA-2026-197.
Inventory all accounts holding delegated role-management privileges and review their assigned index patterns.
Rotate API keys and credentials for any account that could have exercised the delegated privilege before patching.
Review the .security index and current role definitions for unauthorized modifications.

Patch Information

Elastic released fixed builds in Elasticsearch 8.19.22, 9.4.7, and 9.5.4. Refer to the Elastic Discuss Security Update ESA-2026-197 for the complete fix details and upgrade guidance.

Workarounds

Remove the delegated role-management privilege from non-administrative users until the cluster is patched.
Restrict the index pattern on any delegated role to narrow, explicit index names rather than wildcards.
Isolate Elasticsearch management APIs behind network controls that limit access to trusted administrative hosts.

bash

# Example: remove a role that grants broad delegated role-management
curl -X DELETE "https://es.example.com:9200/_security/role/delegated_role_admin" \
  -u elastic:$ES_PASSWORD

# Verify current role definitions
curl -X GET "https://es.example.com:9200/_security/role" \
  -u elastic:$ES_PASSWORD | jq '.[] | select(.indices[].names[] | contains("*"))'